Omit referrers on cross-origin requests from an .onion address (fixes w…

…3c#155)
fmarier · Nov 18, 2021 · 43afe36 · 43afe36
1 parent bbc7291
commit 43afe36
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/index.src.html b/index.src.html
@@ -850,6 +850,12 @@ <h3 id="determine-requests-referrer" dfn export>
       Let request's <dfn>referrerURL</dfn> be the result of <a href="#strip-url">stripping
       <var>referrerSource</var> for use as a referrer.</a>
     </li>
+    <li>
+      If the <a for=url>origin</a> of <a>referrerURL</a> has a <a for=origin>host</a> that
+      ends with <code>.onion.</code> or <code>.onion</code>, the special-use domain name defined
+      in [[!RFC7686]], and the request is a <a>cross-origin-referrer request</a>, then return
+      <code>no referrer</code>.
+    </li>
     <li>
       Let <var>referrerOrigin</var> be the result of
       <a href="#strip-url">stripping <var>referrerSource</var> for use as a